CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0.

• CWE-470

• https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180Release Notes
• https://github.com/remix-run/react-router/commit/9d22943fd46c8ae4b08236425fa3549e10e9ad1aPatch
• https://github.com/remix-run/react-router/pull/15175Issue Tracking, Patch
• https://github.com/remix-run/react-router/releases/tag/react-router@7.18.0Release Notes
• https://github.com/remix-run/react-router/security/advisories/GHSA-337j-9hxr-rhxgThird Party Advisory

Published

Jul 27, 2026

Last Modified

Aug 3, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53655node-tar is a full-featured Tar for Node.js. Prior to 7.5.16…5.5
• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-5366Prefect version 3.6.23 is vulnerable to remote code executio…9.9
• CVE-2026-53661Boruta is a standalone authorization server that aims to imp…8.8
• CVE-2026-53662immich is a high performance self-hosted photo and video man…9.6
• CVE-2026-53663React Router is a router for React. From 7.12.0 until 7.15.1…3.1
• CVE-2026-53667React Router is a router for React. In versions 7.11.0 throu…6.1
• CVE-2026-53668React Router is a router for React. In versions 6.30.2 throu…6.9
• CVE-2026-53669React Router is a router for React. Versions 6.0.0 through 7…6.1
• CVE-2026-5367A flaw was found in OVN (Open Virtual Network). A remote att…8.6
• CVE-2026-53673BuddyPress 14.4.0 contains an insecure direct object referen…8.6
• CVE-2026-53674BuddyPress 14.4.0 contains a regular expression injection vu…7.1